There was a bug in the length checking for encrypted password change
requests from clients. A client could potentially send an encrypted
password, which, when decrypted with the old hashed password could be
used as a buffer overrun attack on the stack of smbd. The attach would
have to be crafted such that converting a DOS codepage string to little
endian UCS2 unicode would translate into an executable block of code.